COA 考试模拟题

version: 201911

Exam Tasks

You are the cloud administrator of a fictitious company named ESCloud. You have been tasked with setting up Openstack Environments for marketing and finance departments.

您是一家名为ESCloud的虚拟公司的云管理员。您的任务是为市场和财务部门设置Openstack环境。

Task 1

The company has two departments, named marketing and finance. For each of the two departments create projects with details below:

该公司有两个部门，分别是市场部和财务部。为两个部门中的每个部门创建项目，其详细信息如下：

Project Name:	marketing	finance
Description:	project for marketing	project for finance

Task 2

Marketing is managed by Roger and finance is managed by Frank. Both are going to be administrators of their respective projects. ESCloud has an engineer named James who will be a member of both departments. Create OpenStack user accounts for Roger, Frank and James with the data sheet below. For roles, please ensure that users only have the roles identified below - any additional default roles should be removed.

营销由罗杰（Roger）管理，财务由弗兰克（Frank）管理。两者都将成为各自项目的管理员。ESCloud拥有一个名为James的工程师，他将是两个部门的成员。使用以下数据表为Roger，Frank和James创建OpenStack用户帐户。对于角色，请确保用户仅具有以下标识的角色-应删除所有其他默认角色。

User name:	roger	frank	james
Email:	@escloud.cn	@escloud.cn	@escloud.cn
Password:	rogerpass	frankpass	jamespass
Role/Project:	admin of marketing	admin of finance	Member of marketing (primary) and finance

Task 3

Management has imposed quotas of 3 VCPUs, 3072 MB of RAM and 3 Gigabytes of disk space (Total Size of Volumes and Snapshots (GB)) for marketing. For finance , quotas are 1 instance and 2 Gigabytes of disk space (Total Size of Volumes and Snapshots (GB)). For both groups, also set a maximum of 2 floating IPs and 2 security groups. Leave the OpenStack defaults for the rest.

管理层已为市场分配了3个VCPU，3072 MB RAM和3 GB磁盘空间（卷和快照总大小）的配额。对于财务而言，配额为1个实例和2 GB的磁盘空间（卷和快照的总大小（GB））。对于这两个组，还最多设置2个浮动IP和2个安全组。其余部分保留OpenStack默认值。

Task 4

For initial tests the company will use a qcow2 image of Cirros, located at http://localhost:8090/mce100.img and named sharedimage. The image must be public so all projects can use it.

对于初始测试，该公司将使用位于http：// localhost：8090 / mce100.img并命名为sharedimage 的Cirros的qcow2图像。该图像必须是公共的，以便所有项目都可以使用它。

Task 5

In addition to the default flavors that come with OpenStack, ESCloud has decided that it needs its own custom flavors for spawning instances using the shared image. Please create the following custom flavors.

除了OpenStack随附的默认样式外，ESCloud还决定它需要自己的自定义样式来使用共享映像生成实例。请创建以下自定义样式。

Flavor name:	mflavor1	mflavor2	fflavor1
VCPUs:	⅓ of quota	⅔ of quota	1
RAM:	⅓ of quota	⅔ of quota	512 MB
Root Disk:	1 GB	2 GB	1 GB
Ephemeral Disk:	0	0	0
Swap Disk:	0	0	0
Accessibility:	marketing	marketing	finance

Task 6

To enable access to the instance from the outside, ESCloud needs an external network. Create an external network with the following settings. ESCloud has decided that the ip range of 172.25.0.1 to 172.25.0.241 are reserved – ensure that they will not be used in this cluster and that DHCP is enabled for this network.

要从外部访问实例，ESCloud需要一个外部网络。使用以下设置创建一个外部网络。ESCloud已决定保留172.25.0.1到172.25.0.241的IP范围-确保它们不会在此群集中使用，并且已为此网络启用DHCP。

name:	project	subnet name	network address	gateway	Provider Network Type	Physical Network	DHCP
public	admin	publicsubnet	172.25.0.0/24	172.25.0.1	Flat	public	Enabled

备注： 本次测试网段：10.5.30.1-----10.5.30.15, 不分配网段10.5.30.1----10.5.30.5

Marketing tasks

Marketing tasks, please complete the following with the roger OpenStack account.

这里注意要切换租户和用户

Task 7

ESCloud wants to ensure the instances in the marketing department can be accessed from outside via ping, web(http and https), and ssh. Create a security group msec (description:msec) with these rules.

ESCloud希望确保可以通过ping，web（http和https）和ssh从外部访问市场部门的实例。使用这些规则创建安全组msec（描述：msec）。

Task 8

Create a keypair rogerkey and store the downloaded key(rogerkey.pem) in /tmp/ of the clab environment with permissions set to 600.
• Task 9: In order to boot instances, we need to create a network for marketing. Create a network with the following settings.

创建密钥对rogerkey并将下载的密钥（rogerkey.pem）存储在clab环境的/ tmp /中，权限设置为600。
•任务9：为了启动实例，我们需要创建一个营销网络。使用以下设置创建网络。

Task 9

In order to boot instances, we need to create a network for marketing. Create a network with the following settings.

为了启动实例，我们需要创建一个营销网络。使用以下设置创建网络。

name:	subnet name	network address	gateway
mnet	msubnet	10.1.0.0/24	10.1.0.1

Task 10

Create a router with name mrouter and connect mnet to public with it.

创建一个名称为mrouter的路由器，并将mnet连接到public。

name:	flavor	keypair	network	image	Create New Volume	Sec Group
minstance1	mflavor1	rogerkey	mnet	sharedimage	No	msec
minstance2	mflavor2	rogerkey	mnet	sharedimage	No	msec

Task 11

Create two compute instances for marketing using the table below.

使用下表创建两个用于市场营销的计算实例。

name:	flavor	keypair	network	image	Create New Volume	Sec Group
minstance1	mflavor1	rogerkey	mnet	sharedimage	No	msec
minstance2	mflavor2	rogerkey	mnet	sharedimage	No	msec

Task 12

Marketing needs these two instances to be accessible from the outside via specific ip addresses.

市场营销需要可以通过特定的ip地址从外部访问这两个实例。

Floatingip:	172.25.0.244	172.25.0.245
Instance:	minstance1	minstance2

Task 13

Marketing needs to store important files on a volume so it will retain the data even if minstance1 is terminated. Create the volume with the name mvolume and 1GB size and attach it to minstance1.

市场营销需要将重要文件存储在一个卷上，因此即使minstance1终止，它也将保留数据。创建名称为mvolume且大小为1GB的卷，并将其附加到minstance1。

Task 14

Test ping and ssh(as cirros) from the host to your marketing instances using keys via floating ips.

使用通过浮动ip的密钥，从主机到您的营销实例测试ping和ssh（作为cirros）。

Finance task

Finance tasks, please complete the following with the frank OpenStack account using command line. (Important: If you are found to have completed the section below using Horizon/UI, you will forfeit points for the exam.)

这里注意要切换租户和用户

财务任务，请使用命令行使用坦率的OpenStack帐户完成以下操作。（重要提示：如果发现您已使用Horizo​​n / UI完成了以下部分，则将丧失该考试的分数。）

Task 15

We want to ensure the instances in the finance department can be accessed via ssh. Create a security group fsec with this rule.

我们希望确保可以通过ssh访问财务部门中的实例。使用此规则创建安全组fsec。

答案：

openstack security group create fsec --project finance --description fsec
openstack security group rule create --dst-port 22 --protocol tcp fsec

注意检查结果：

[root@openstack1 tmp]# openstack security group rule list msec --long
+--------------------------------------+-------------+-----------+------------+-----------+-----------+-----------------------+
| ID                                   | IP Protocol | IP Range  | Port Range | Direction | Ethertype | Remote Security Group |
+--------------------------------------+-------------+-----------+------------+-----------+-----------+-----------------------+
| 2f319d18-125b-4ffe-a79d-97f849a27ea4 | None        | None      |            | egress    | IPv4      | None                  |
| 4b5b209f-7bd2-4ca6-a9f4-91691eda9001 | icmp        | 0.0.0.0/0 |            | ingress   | IPv4      | None                  |
| 64bb6b3f-f33f-4dd2-bdfa-98280124a84d | tcp         | 0.0.0.0/0 | 80:80      | ingress   | IPv4      | None                  |
| 9e75a6e3-29bb-4ff1-8eb9-5cef6a104bc4 | tcp         | 0.0.0.0/0 | 443:443    | ingress   | IPv4      | None                  |
| bb22abf6-af3e-499e-a75e-78d17bc2d773 | tcp         | 0.0.0.0/0 | 22:22      | egress    | IPv4      | None                  |
| d22144be-5938-40a0-a2b8-43d29406b56c | None        | None      |            | egress    | IPv6      | None                  |
| d3c29271-6a48-4b9a-af14-a67935454976 | tcp         | 0.0.0.0/0 | 22:22      | ingress   | IPv4      | None                  |
+--------------------------------------+-------------+-----------+------------+-----------+-----------+-----------------------+

Task 16

Create a keypair named frankkey. Store this key with permissions set to 600 as /tmp/frankkey.pem folder of the exam environmentf

创建一个名为frankkey的密钥对。将此密钥（权限设置为600）存储为考试环境的/tmp/frankkey.pem文件夹。

答案：

openstack keypair create frankkey > /tmp/frankkey.pem
chmod 600 /tmp/frankkey.pem

Task 17

Create a network fnet with a subnet fsubnet and IP range 10.2.0.0/24.

创建一个子网为fsubnet且IP范围为10.2.0.0/24的网络fnet。

答案：

openstack network create fnet --project finance
openstack subnet create fsubnet --network fnet --subnet-range 10.2.0.0/24

Task 18

Create router frouter and connect fnet to public with it

创建路由器frouter并将其与fnet连接到公共

答案：

openstack router create --project finance frouter
openstack router set --external-gateway public
openstack router add subnet frouter fsubnet

Task 19

Create the following instance:

name:	flavor	keypair	network	image	Sec Group
finstance1	fflavor1	frankkey	fnet	sharedimage	fsec

答案：

openstack server create finstance1 --flavor fflavor1 --key-name frankkey --network fnet --image sharedimage --security-group fsec

Task 20

Assign the floating IP 172.25.0.247 to the finstance1

将浮动IP 172.25.0.247分配给finstance1

答案：

openstack floating ip create --floating-ip-address 10.5.30.13 public
openstack server add floating ip finstance1 10.5.30.13

Task 21

Upload the file test.mov, which is located in /opt/stack/files/ on your clab environment, into a Swift container named Movies. Ensure that the object name is test.mov.

将文件ctest.mov（位于您的实验室环境中的/opt/stack/files/中）上传到名为Movies的Swift容器中。确保对象名称为test.mov。

答案：

source xxx-openrc.sh
cd /opt/stack/files/ 
swift upload Movies test.mov

Task 22

Test the finance instance. Verify if you can ssh into the floating IP as user cirros with the key generated.

测试财务实例。验证是否可以使用生成的密钥作为用户cirros进入浮动IP。

答案：

ssh -i /tmp/frankkey.pem cirros@10.5.30.13

Task 23

Finally, implement a policy change that allows only administrators to create volumes and networks.

最后，实施策略更改，仅允许管理员创建卷和网络。

答案：